This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages)(Learn how and when to remove this template message)
|Security Access Control methods|
HTTP 403 is a standard HTTP status code communicated to clients by an HTTP server to indicate that the server understood the request, but will not fulfill it. There are a number of sub-status error codes that provide a more specific reason for responding with the 403 status code.
HTTP 403 provides a distinct error case from HTTP 401; while HTTP 401 is returned when the client has not authenticated, and implies that a successful response may be returned following valid authentication, HTTP 403 is returned when the client is not permitted access to the resource for some reason besides authentication. This other reason needs to be acted upon before re-requesting access to the resource.
Error 403: "The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated."
Error 401: "The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials." RFC2616
See "403 substatus error codes for IIS" for possible reasons of why the webserver is refusing to fulfill the request.
The Apache web server returns 403 Forbidden in response to requests for URL paths that correspond to file system directories when directory listings have been disabled in the server and there is no Directory Index directive to specify an existing file to be returned to the browser. Some administrators configure the Mod proxy extension to Apache to block such requests and this will also return 403 Forbidden. Microsoft IIS responds in the same way when directory listings are denied in that server. In WebDAV, the 403 Forbidden response will be returned by the server if the client issued a PROPFIND request but did not also issue the required Depth header or issued a Depth header of infinity
403 substatus error codes for IIS
- 403.1 - Execute access forbidden.
- 403.2 - Read access forbidden.
- 403.3 - Write access forbidden.
- 403.4 - SSL required
- 403.5 - SSL 128 required.
- 403.6 - IP address rejected.
- 403.7 - Client certificate required.
- 403.8 - Site access denied.
- 403.9 - Too many users.
- 403.10 - Invalid configuration.
- 403.11 - Password change.
- 403.12 - Mapper denied access.
- 403.13 - Client certificate revoked.
- 403.14 - Directory listing denied.
- 403.15 - Client Access Licenses exceeded.
- 403.16 - Client certificate is untrusted or invalid.
- 403.17 - Client certificate has expired or is not yet valid.
- 403.18 - Cannot execute request from that application pool.
- 403.19 - Cannot execute CGIs for the client in this application pool.
- 403.20 - Passport logon failed.
- 403.21 - Source access denied.
- 403.22 - Infinite depth is denied.
- 403.502 - Too many requests from the same client IP; Dynamic IP Restriction limit reached.
- "RFC 2616 - Hypertext Transfer Protocol - HTTP/1.1". Tools.ietf.org. Retrieved 2018-04-09.
- "HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV)". IETF. June 2007. Archived from the original on March 3, 2016. Retrieved January 11, 2016.